Why won't my VPN app connect?
If you saw the "Devices blocked by DNS protection" card in the panel, you are in the right place. Short explanation and two fixes below.
What is happening?
To keep your DNS queries from leaking, Clutch blocks devices on your network from using encrypted DNS (DoT, TCP port 853) on their own. That way every device goes through Clutch's encrypted DNS.
Some VPN apps try to resolve DNS over DoT before connecting. Cloudflare WARP, for example, runs in "warp+dot" mode by default; with 853 closed it cannot connect, and the WARP log shows "DNSLookupFailed".
Recommended fix: switch the DNS protocol to DoH
Change your VPN app's DNS protocol to DNS over HTTPS (DoH). DoH uses the regular HTTPS port (443), so it is not blocked, and DNS protection stays on.
WARP (1.1.1.1) app: Preferences → Connection options → DNS protocol → "DNS over HTTPS"
From the command line:
warp-cli mode warp+dohOn our own test line, WARP connected right after this change.
Alternative: an exception for that device only
If the app has no DoH option, open Network → DNS in the panel and use "Allow port 853" for that device in the "Devices blocked by DNS protection" card.
Heads-up: DNS protection is turned off for the device you exempt. Its DNS queries may no longer go through Clutch. You can revoke the exception from the same card at any time.
Honest note: WARP does not lower ping
Using WARP as a full tunnel for gaming increases ping on most servers. Our own measurement (Izmir, Kablonet line, WARP full tunnel vs. direct, 2 runs):
- Vienna: −9 ms (56 → 47 ms)
- Frankfurt: +16 ms
- Google: +28 ms
Results depend on the destination and the line; one line's measurement is not a generalization. If you use a VPN for privacy or access rather than gaming, the DoH fix above is all you need.
Privacy
The panel card shows blocked devices only inside your own network. Device MAC/IP addresses are not sent out; the record that leaves the device for this event carries no address information.